HackingHealthcareHealthcareCustomer Data InvolvedIdentity (basic)LowContained

The Kendal Corporation

bd_a5608ebfb0a0bf05 · schema v1 · pii pii-v1

Severity

Low

Discovered

Jun 30, 2024

Filed

Sep 11, 2024

To disclose

10 weeks

Affected

Not disclosed

Linked

9 filings

Confidence

66%

Full breach record for The Kendal Corporation →2 incidents on file

The Kendal Corporation notified consumers of a data breach involving unauthorized access to member information stored on its network between June 26 and June 30, 2024. The incident involved names combined with other personal data. The company engaged third-party forensic specialists, notified law enforcement, and offered credit monitoring services.

J jump to incidentP pin to compareR raw source

Vermont clock✗ VT AG >45 bday10 weeks discovery → filing

⚠ unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Incident timeline

undetected · 4 days

discovery → filing · 10 weeks / 73 days

Jun 26, 2024

Begins

Jun 30, 2024

Discovered

Sep 11, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 9 filings about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (8) · sorted by filing gap

Massachusetts State AGbd_8b46f4edc90833192024-09-17 · +6dVerified
New Hampshire State AGbd_c2e8744075523f9e2024-09-17 · +6dVerified
Illinois State AGbd_a76228390d64af412024-12-01 · +81dVerified
Indiana State AGbd_42d2c8983f75f43c2024-12-27 · +107dVerified

Show 4 more filings ↓up to 113d gap

Vermont State AGbd_dbebfd707b1fce332024-12-30 · +110dVerified
Maine State AGbd_c31911bef98904e52024-12-31 · +111dVerified
New Hampshire State AGbd_58ba581dac7634812025-01-02 · +113dVerified
Massachusetts State AGbd_a890602740bd78402025-01-02 · +113dVerified

Name: The Kendal Corporation
norm: the kendal

Name: The Kendal Corporation
norm: the kendal
Industry: Healthcarellm

Discovered: Jun 30, 2024
Breach occurred: Jun 26, 2024 – Jun 30, 2024
Undetected for: 4 daysoccurrence → discovery
Materiality determined: —
Notification sent: Sep 11, 2024
Affected individuals: Not disclosed
Data types: Identity (basic)
Attack vector: Unauthorized Access
MITRE ATT&CK: T1078 Valid Accounts
Threat actor: External
Initial access: valid_credentials

During the incident: Notified law enforcement
Conducted a thorough forensic investigation with the assistance of third-party specialists
Offering access to ## months of complimentary credit monitoring and identity protection services
Changes made: Review data protection policies and procedures
Introduce additional safeguards to minimize the chance of a similar incident occurring in the future
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 10 weeks(73 days from discovery to filing)
Compliance flags: VT AG >45 bday
Discovery-date grounding: unattributedNo provenance was recorded for this discovery date and it matches no other date on the record. It may be correct, but it is not independently grounded.

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 9 filings · 6 states

View merged incident ↗

Vermont State AGSep 11 · first · this page

Massachusetts State AG+6d

New Hampshire State AG+6d

Illinois State AG+81d

Indiana State AG+107d

Vermont State AG+110d

Maine State AG+111d

New Hampshire State AG+113d

Massachusetts State AG+113d

Pattern: first filing Sep 11 (VT), last Jan 2 (MA) — a 113-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://ago.vermont.gov/document/2024-09-11-kendal-corporation-data-breach-notice-consumers
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Sep 11, 2024
Raw hash: 956a5d7a0bcba9797706ff8834690963ea76becbd641751baf9b26524256b0a6

Linked disclosures

Regulatory filings (8) · sorted by filing gap

Reporting entityThe Kendal Corporation

Victim entityThe Kendal Corporation

Incidentdiscovered Jun 30, 2024

Stated responseNotified law enforcement

ComplianceVT AG >45 bday

Extraction provenanceno artifact recorded

Source provenanceago.vermont.gov